NASCUS Summary: Joint Agency Proposed Third-Party Risk Management Guidance
September 2026
On September 11, 2026, NCUA, FDIC, Treasury, the Federal Reserve, and the OCC issued a request for comment on proposed third-party risk management guidance. The proposed guidance would incorporate experience and lessons learned around third-party risk management practices, with a focus on the benefits of utilizing a risk-based approach toward third-party relationships. The agencies plan to rescind and replace existing guidance on third-party risk management to promote consistency and innovation.
Comments are due November 16, 2026.
Overview
The proposed guidance addresses that financial organizations (FIs) of all sizes rely on third-party products, services, and other activities to operate as effectively as possible, while also meeting member expectations. This has become more prevalent in recent years by affording FIs access to various technological advances, innovations, improved products, and improved efficiencies, to name a few, that they otherwise may not have been able to create. But, with that comes the possible introduction of new risks, or amplified risks, to the FIs and its members.
FIs have the responsibility to create and maintain sound risk management practices that comply with laws and regulations. The proposed guidance provides risk management principles to assist FIs in identifying, assessing, and managing risks associated with third-party relationships.
The proposed guidance defines third-party relationships as: a business arrangement between a banking organization and an entity or individual for the provision of one or more products, services, and other activities that support the banking organization.
The proposed guidance states that a principles-based approach should be utilized by FIs to make sure it operates safely, and adopts risk management practices that work best in managing the risks it faces, related to its size, complexity, and risk profile with its third-party relationships.
Non-Enforceable Guidance. The proposed guidance states that it is not creating enforceable standards or prescriptive requirements, and that accordingly, it will not result in supervisory actions against an FI. It goes on to state: agencies may take action for violations of laws or regulations, unsafe or unsound practices, or other material risks that result from insufficient management of third-party risk.
Existing NCUA Guidance and Rescission
As mentioned in the introduction, the agencies state that, upon finalization, they plan to rescind and replace existing third-party risk management guidance to promote consistency. NCUA currently maintains multiple active guidance documents addressing third-party risk management, including: Letters to Credit Unions 01-CU-20 Due Diligence Over Third Party Service Providers; Letters to Credit Unions 07-CU-13 Evaluating Third Party Relationships; and Supervisory Letter 07-01 Evaluating Third Party Relationships. So, although the proposal indicates that existing guidance will be rescinded and replaced, it does not specifically identify the individual NCUA guidance documents that would be rescinded.
Risk Management Components
The proposed guidance presents four components for FIs to consider around management of third-party risk:
- Identifying and assessing applicable risks;
- Overseeing risk proportionate to their significance;
- Making informed decisions about residual risks and risk acceptance;
- Establishing appropriate governance practices.
Risk Identification and Assessment
Third-Party Relationship Identification. Third-party risk management generally begins with identifying and categorizing the relationships. Maintaining an inventory of these relationships may be useful for FIs for managing their third-party risks. The approach may vary based on the FIs size, complexity, and the risks posed by the relationships.
Risk Identification. After identification and categorization has occurred with the third-party relationships, FIs should identify relevant risks associated with the relationships. The proposed guidance notes that risks associated with third-party relationships are varied, may change over time, and are not always immediately apparent. Subject-matter experts should be included, as appropriate, during the risk identification process.
Risk Assessment. The proposed guidance addresses that not all third-party relationships present the same level of risk, and that conducting risk assessments will vary. FIs may consider factors such as the potential magnitude of harm to an FI or its members, the activities that are performed by the third-party, as well as the third-party’s regulatory status and obligations.
Risk assessments may be conducted for the overall relationship, or individual activities, and may be adjusted after the initial risk assessment as additional information becomes available through various due diligence processes. The proposed guidance also notes that examiners will give due consideration to an FI’s reasonable judgment regarding its risk assessment.
Risk Oversight
Due Diligence and Third-Party Selection. The proposed guidance states that due diligence is how an FI assesses a third party’s ability to perform the activity it provides, while adhering to the FI’s policies, complying with laws and regulations, and conducting the activity in a safe and sound manner. The oversight and necessary due diligence depend on the degree of risks presented by the third-party relationship.
Contract Negotiation. The proposed guidance states that contract negotiations should reflect the risks identified through the FIs risk assessment and due diligence processes and establish appropriate expectations for managing the third-party relationship. FIs may benefit from maintaining an inventory of their existing third-party contracts and periodically evaluating whether existing provisions remain appropriate as risk or circumstances change. When this occurs, FIs may determine that revisions to a contract may be warranted.
Ongoing Monitoring. The proposed guidance defines ongoing monitoring as: the process by which banking organizations assess and monitor third-party performance and changes in the risks posed by third-party relationships. It states that ongoing monitoring may enable an FI to:
- Confirm the quality of a third-party’s controls and ability to meet contractual obligations and perform as expected;
- Identify significant issues or concerns (audit findings, deterioration in financial condition, security breaches, etc.);
- Respond to such significant issues or concerns when identified.
Examples of monitoring include:
- Review of updates to information utilized in due diligence;
- Periodic visits and meetings with third-party representatives;
- Testing of FI’s controls that manage risks associated with third-party;
- Reviews of public filings or reports or examination;
- Review of customer complaints.
Ongoing monitoring may occur on a periodic or continuous basis, based on the FI’s assessment of risk, complexity, and overall third-party relationship. As the types and levels of risk change over the life of the third-party relationship, an FI may need to adjust monitoring practices, as needed.
Termination. Termination of third-party relationships may occur for various reasons, including expiration or breach of contract, third-party performance issues, or an FI’s decision to utilize an alternate provider. Decisions to terminate a relationship and transition to another third-party may involve multiple considerations related to the FI’s business, strategy, and risk appetite. The proposed guidance notes that examiners will give due considerations to an FI’s reasonable determination that an alternative third-party can provide services within its risk appetite and tolerances.
Cross-Cutting Oversight Topics. The proposed guidance encourages FIs to consider third-party risk management holistically rather than viewing individual stages in a siloed manner. Risks and mitigating factors may extend across multiple stages of the relationship, and FIs may consider a variety of approaches and resources to support the oversight, including management of sub-contractor risks, collaborative arrangements, or other external expertise, as well as other risk mitigation tools.
Operational Resilience Planning. Effective risk oversight should consider the potential impact of disruptions involving third-party relationships and the FI’s ability to continue critical operations. FIs may consider contractual obligations related to review of a third-party’s own operational resilience and contingency capabilities, as well as alternative options that may be available to the FI if services are disrupted or become unavailable.
Residual Risk Acceptance
Residual risk is the remaining risk after an FI has implemented mitigating controls. The proposed guidance recognizes that it does not expect FIs to eliminate all third-party risk and understands that residual risk is unavoidable. FIs should determine what level of residual risk is acceptable within their established risk appetite and tolerances while continuing to operate in a safe and sound manner.
Governance
The proposed guidance states that for an FI to support its overall third-party risk management practices, it may consider adopting governance policies that:
- Establish clear roles and responsibilities;
- Establish an appropriate risk appetite and appropriate risk tolerances related to risks from third-party relationships;
- Help ensure that an FI can identify and assess third-party risk, and prioritize risk based on the FI’s risk appetite and tolerances;
- Establish appropriate reporting to senior management and board;
- Document key elements of risk management for third-party relationships, and
- Establish a process for conducting periodic independent reviews to assess effectiveness of the FI’s third-party risk management practices.
Key Considerations
- The proposed guidance provides emphasis on allowing FIs to tailor third-party risk management practices based on the risk presented by individual relationships, rather than a one size fits all approach. The agencies repeatedly emphasize consideration around an FI’s size, complexity, risk profile, along with the nature of the third-party relationships.
- The agencies request feedback on multiple areas throughout the proposed guidance. Two questions that seem particularly relevant include:
- To what extent it would be helpful for the guidance to include a list of characteristics that would indicate that a third-party relationship is higher risk, and what characteristics should be included.
- Whether the proposed guidance should only apply to third-party relationships that are subject to a written agreement with the FI and whether this would provide greater clarity around the scope of the guidance.